One embodiment of the present invention provides a system for emulating computer viruses and/or malicious software that operates by patching additional program instructions into an emulator in order to aid in detecting a computer virus and/or malicious software within suspect code. During operation, the system loads a first emulator extension into the emulator. This first emulator extension includes program instructions that aid in the process of emulating the suspect code in order to detect a computer virus and/or malicious software. The system also loads the suspect code into an emulator buffer. Next, the system performs an emulation using the first emulator extension and the suspect code. This emulation is performed within an insulated environment in a computer system so that the computer system is insulated from malicious actions of the suspect code. During this emulation, the system determines whether the suspect code is likely to exhibit malicious behavior. In one embodiment of the present invention, loading the first emulator extension into the emulator involves loading the first emulator extension into the emulator buffer within the emulator. In this embodiment, performing the emulation involves emulating the program instructions that comprise the first emulator extension.
|
1. A method for emulating computer viruses and/or malicious software that operates by patching additional program instructions into an emulator in order to aid in detecting a computer virus and/or malicious software within suspect code, the method comprising:
receiving the suspect code;
loading the suspect code into an emulator buffer within a data space of a computer system;
loading a first emulator extension into the emulator, the emulator capable of performing an emulation using emulation code, the first emulator extension including program instructions that aid in the process of emulating the suspect code in order to detect a computer virus and/or malicious software, wherein the program instructions of the first emulator extension are additional beyond that associated with the emulator code, for assisting the emulator code in the emulation by patching the additional program instructions into the emulator in order to aid in detecting the computer virus and/or malicious software within the suspect code;
performing the emulation using the first emulator extension, the emulation code and the suspect code, the emulation being performed within an insulated environment in the computer system so that the computer system is insulated from malicious actions of the suspect code; and
determining whether the suspect code is likely to exhibit malicious behavior based upon the emulation.
14. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for emulating computer viruses and/or malicious software that operates by patching additional program instructions into an emulator in order to aid in detecting a computer virus and/or malicious software within suspect code, the method comprising:
receiving the suspect code;
loading the suspect code into an emulator buffer within a data space of a computer system;
loading a first emulator extension into the emulator, the emulator capable of performing an emulation using emulation code, the first emulator extension including program instructions that aid in the process of emulating the suspect code in order to detect a computer virus and/or malicious software, wherein the program instructions of the first emulator extension are additional beyond that associated with the emulator code, for assisting the emulator code in the emulation by patching the additional program instructions into the emulator in order to aid in detecting the computer virus and/or malicious software within the suspect code;
performing the emulation using the first emulator extension, the emulation code and the suspect code, the emulation being performed within an insulated environment in the computer system so that the computer system is insulated from malicious actions of the suspect code; and
determining whether the suspect code is likely to exhibit malicious behavior based upon the emulation.
26. An apparatus that emulates computer viruses and/or malicious software that operates by patching additional program instructions into an emulator in order to aid in detecting a computer virus and/or malicious software within suspect code, the apparatus comprising:
a loading mechanism that is configured to load the suspect code into an emulator buffer within a data space of a computer system;
wherein the loading mechanism is additionally configured to load a first emulator extension into the emulator, the emulator capable of performing an emulation using emulation code, the first emulator extension including program instructions that aid in the process of emulating the suspect code in order to detect a computer virus and/or malicious software, wherein the program instructions of the first emulator extension are additional beyond that associated with the emulator code, for assisting the emulator code in the emulation by patching the additional program instructions into the emulator in order to aid in detecting the computer virus and/or malicious software within the suspect code;
an emulation mechanism that is configured to perform the emulation using the first emulator extension, the emulation code and the suspect code, the emulation being performed within an insulated environment in the computer system so that the computer system is insulated from malicious actions of the suspect code; and
a determination mechanism that is configured to determine whether the suspect code is likely to exhibit malicious behavior based upon the emulation.
2. The method of
wherein performing the emulation includes emulating the program instructions that comprise the first emulator extension.
3. The method of
4. The method of
5. The method of
6. The method of
loading a second emulator extension into the emulator; and
performing a second emulation using the second emulator extension and the suspect code.
7. The method of
8. The method of
9. The method of
10. The method of
11. The method of
12. The method of
13. The method of
15. The computer-readable storage medium of
wherein performing the emulation includes emulating the program instructions that comprise the first emulator extension.
16. The computer-readable storage medium of
17. The computer-readable storage medium of
18. The computer-readable storage medium of
19. The computer-readable storage medium of
loading a second emulator extension into the emulator; and
performing a second emulation using the second emulator extension and the suspect code.
20. The computer-readable storage medium of
21. The computer-readable storage medium of
22. The computer-readable storage medium of
23. The computer-readable storage medium of
24. The computer-readable storage medium of
25. The computer-readable storage medium of
27. The apparatus of
wherein the emulation mechanism is configured to emulate the program instructions that comprise the first emulator extension.
28. The apparatus of
29. The apparatus of
30. The apparatus of
31. The apparatus of
load a second emulator extension into the emulator; and to
perform a second emulation using the second emulator extension and the suspect code.
32. The apparatus of
33. The apparatus of
34. The apparatus of
35. The apparatus of
36. The apparatus of
37. The apparatus of
|
|||||||||||||||||||||||||
1. Field of the Invention
The present invention relates to systems for detecting computer viruses and malicious software. More specifically, the present invention relates to a method and an apparatus for emulating computer viruses or other malicious software that operates by patching additional instructions into an emulator in order to aid in the process of detecting, decrypting or disinfecting code containing a computer virus or other malicious software.
2. Related Art
Malicious software, such as a computer virus, can enter a computer system in a number of ways. It can be introduced on a disk or a CD-ROM that is inserted into the computer system. It can also enter from a computer network, for example, within an email message.
If malicious software is executed by a computer system, it can cause a number of problems. The software can compromise security, by stealing passwords; by creating a “back door” into the computer system; or by otherwise accessing sensitive information. The software can also cause damage to the computer system, for example, by deleting files or by causing the computer system to fail.
Some types of malicious programs can be easily detected using simple detection techniques, such as scanning for a search string. However, this type of detection process can be easily subverted by converting a malicious algorithm into program code in different ways.
Another approach to detecting malicious software is to run a program on a real machine while attempting to intercept malicious actions. This technique, which is known as “behavior blocking,” has a number of disadvantages. In spite of the attempt to intercept malicious actions, the program may nevertheless cause harm to the computer system. Furthermore, the behavior blocking mechanism typically cannot view an entire log of actions in making a blocking determination. Hence, the behavior blocking mechanism may make sub-optimal blocking decisions, which means harmless programs may be blocked or harmful programs may be allowed to execute.
Yet another approach to detecting malicious software is to “emulate” suspect code within an insulated environment in a computer system so that the computer system is protected from malicious actions of the suspect code.
One disadvantage to emulation is that it is almost impossible to provide complete emulation for all program instructions, all operating system calls and operating system environments that may be accessed by a piece of code being emulated without replicating the entire operating system in the process. Hence, in practice, emulators are typically able to emulate only commonly occurring program instructions and system calls.
This problem can be overcome by updating and recompiling an emulator to implement new system calls and new program instructions as different pieces of malicious software are encountered that make use of these new system calls and new program instructions. However, doing so can lead to logistical problems in keeping emulation programs up to date.
Another problem with current emulators is that they cannot deal with conflicting emulator environments. For example, one virus may be triggered by a system call returning the year 1999, while another virus is triggered by the same system call returning the year 2000.
What is needed is a method and an apparatus for emulating suspect code that can be easily reconfigured to accommodate new program instructions, system calls and emulation environments.
One embodiment of the present invention provides a system for emulating computer viruses and/or malicious software that operates by patching additional program instructions into an emulator in order to aid in detecting a computer virus and/or malicious software within suspect code. During operation, the system loads a first emulator extension into the emulator. This first emulator extension includes program instructions that aid in the process of emulating the suspect code in order to detect a computer virus and/or malicious software. The system also loads the suspect code into an emulator buffer within a data space of a computer system. Next, the system performs an emulation using the first emulator extension and the suspect code. This emulation is performed within an insulated environment in the computer system so that the computer system is insulated from malicious actions of the suspect code. During this emulation, the system determines whether the suspect code is likely to exhibit malicious behavior.
In one embodiment of the present invention, loading the first emulator extension into the emulator involves loading the first emulator extension into the emulator buffer within the emulator. In this embodiment, performing the emulation involves emulating the program instructions that comprise the first emulator extension.
In one embodiment of the present invention, emulating the program instructions that comprise the first emulator extension causes the emulator to examine the suspect code looking for patterns that indicate that the suspect code is likely to exhibit malicious behavior.
In one embodiment of the present invention, emulating the program instructions that comprise the first emulator extension causes the program instructions within the first emulator extension to facilitate emulation of the suspect code.
In one embodiment of the present invention, prior to loading the first emulator extension into the emulator buffer, the system emulates the suspect code without using the first emulator extension.
In one embodiment of the present invention, the system additionally loads a second emulator extension into the emulator, and performs a second emulation using the second emulator extension and the suspect code. In a variation on this embodiment, the first emulator extension implements a first emulation environment that conflicts with a second emulation environment that is implemented by the second emulator extension.
In one embodiment of the present invention, loading the first emulator extension involves loading the first emulator extension from a database containing a plurality of different emulator extensions.
In one embodiment of the present invention, the first emulator extension includes code for decrypting an encrypted computer virus.
In one embodiment of the present invention, if a computer virus or other malicious software is detected within the suspect code, the system additionally disinfects the suspect code.
In one embodiment of the present invention, the first emulator extension facilitates emulating a non-standard computer instruction opcode.
In one embodiment of the present invention, the first emulator extension facilitates emulating an uncommonly used operating system call.
The following description is presented to enable any person skilled in the art to make and use the invention, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present invention. Thus, the present invention is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.
The data structures and code described in this detailed description are typically stored on a computer readable storage medium, which may be any device or medium that can store code and/or data for use by a computer system. This includes, but is not limited to, magnetic and optical storage devices such as disk drives, magnetic tape, CDs (compact discs) and DVDs (digital video discs), and computer instruction signals embodied in a transmission medium (with or without a carrier wave upon which the signals are modulated). For example, the transmission medium may include a communications network, such as the Internet.
Computer System
Computer system 106 can receive suspect code 108 (which can potentially be malicious) from a number of different sources. Suspect code 108 may be introduced into computer system 106 by a remote host 101 across a network 102. For example, suspect code 108 may be included within an electronic mail (email) message from remote host 101 to computer system 106. Remote host 101 can include any entity that is capable of sending suspect code 108 across network 102 to computer system 106. Network 102 can include any type of wire or wireless communication channel capable of coupling together computing nodes. This includes, but is not limited to, a local area network, a wide area network, or a combination of networks. In one embodiment of the present invention, network 102 includes the Internet.
Suspect code 108 may additionally be introduced into computer system 106 by encoding suspect code 108 on a computer-readable storage medium, such as disk 104, and introducing disk 104 into computer system 106. Note that disk 104 can generally include any type of computer-readable storage medium, such as a magnetic disk, a magnetic tape and a CD-ROM.
Before executing suspect code 108, computer system 106 uses emulator 110 to analyze suspect code 108. Emulator 110 analyzes suspect code 108 by executing emulator code 203 and emulator extensions 204 as is described below with reference to
Emulator Structure
Emulator buffer 201 is a protected region of memory (also known as a sandbox or a working space) in which suspect code 108 is stored and emulated. Emulator buffer 201 stores suspect code 108 as well as emulator extension 204. Emulator buffer 201 and emulator code 203 are designed so that while suspect code 108 that is executing within emulator buffer 201, suspect code 108 cannot damage or compromise computer system 106. Emulator extension 204 includes additional program instructions that assist emulator code 203 in the emulation process.
Note that emulator buffer 201 is not within the program space of computer system 106, but is instead in the data space. Hence, instructions within emulator extension 204 must themselves be emulated by emulator code 203. In an alternative embodiment of the present invention, emulator extension 204 is loaded as a patch into the program space of computer system 106. In this alternative embodiment, emulator extension can be executed directly on computer system 106.
Emulator extension 204 is retrieved from database 206, which contains a plurality of emulator extensions 208, which can be successively loaded into emulator buffer 201 during the emulation process. Database 206 can include any type of volatile or non-volatile memory or storage device that can be used to store emulator extensions 208. Database 206 can reside within computer system 106, or alternatively, can reside on an external database server that is separate from computer system 106.
During the emulation process, emulator extension 204 can read suspect code 108 looking for patterns indicating the suspect code 108 contains a virus or other type of malicious software. Alternatively, emulator extension 204 can set up an environment that is conducive to emulating suspect code 108. For example, emulator extension 204 can configure the system to emulate uncommonly used system calls or opcodes. This enables emulator code 203 and/or emulator extension 204 to determine of suspect code 108 exhibits malicious behavior. Emulator code 203 (working with emulator extension 204) ultimately outputs a decision 212 indicating whether suspect code 108 is malicious or not.
Note that emulator extension 204 can be emulated in a number of different ways. (1) Emulator extension 204 can be emulated as part of suspect code 108 by patching the emulator extension 204 into suspect code 108, possibly replacing, overlapping or overwriting portions of suspect code 108. In this case, the location where the patching occurs is defined in the database 206. (2) Emulator extension 204 can be executed before the suspect code 108 is executed, which enables emulator extension 204 to set up the environment that emulator extension 204 is responsible for handling. After this environment is set up, emulator extension 204 passes control suspect code 108. (3) Emulator extension 204 can replace suspect code 108 entirely. In this case, the suspect code 108 is not emulated at all, and emulator extension 204 produces decision 212 after analyzing the suspect code 108 as data. (4) Emulator extension 204 can be emulated after the suspect code 108 is emulated. This allows emulator extension 204 to analyze the results of running the suspect code 108 in order to produce decision 212.
Process of Emulation
Next, the system runs emulator 110 (step 306). This causes suspect code 108 to be examined and/or emulated by emulator code 203. During the emulation process, the system determines whether or not suspect code 108 contains code that is likely to exhibit malicious behavior (step 308). If so, the system reports the malicious code to a system user or system administrator (step 310).
If no malicious code is detected, the system determines if there are any emulator extensions remaining in database 206 that have not already been used (step 312). If not, the system proceeds to the next file containing suspect code to repeat the entire process (step 314).
Otherwise, if there are emulator extensions remaining, the system loads the next emulator extension into emulator 110 (step 315). In one embodiment of the present invention, this involves loading emulator extension 204 into emulator buffer 201 within emulator 110. In an alternative embodiment, this involves loading emulator extension 204 into the program space of computer system 106 so that it can work in concert with emulator code 203 in performing a subsequent emulation.
Next, the system sets up emulator 110 to run emulator extension 204 (step 316). This may involve configuring emulator code 203 to initially run emulator extension 204. Next, the system returns to step 306 to continue with the emulation process using the new emulator extension.
Note that by using multiple emulator extensions it is possible to deal with conflicting emulator environments. For example, a first emulator extension can configure emulator 110 to detect a virus that is triggered by a system call returning the year 1999, while a second emulator extension can configure emulator 110 to detect a virus that is triggered by the same system call returning the year 2000.
The foregoing descriptions of embodiments of the invention have been presented for purposes of illustration and description only. They are not intended to be exhaustive or to limit the present invention to the forms disclosed. Accordingly, many modifications and variations will be apparent to practitioners skilled in the art. Additionally, the above disclosure is not intended to limit the present invention. The scope of the present invention is defined by the appended claims.
| Patent | Priority | Assignee | Title |
| 10019338, | Feb 23 2013 | FireEye Security Holdings US LLC | User interface with real-time visual playback along with synchronous textual analysis log display and event/time index for anomalous behavior detection in applications |
| 10021124, | Jul 01 2003 | SecurityProfiling, LLC | Computer program product and apparatus for multi-path remediation |
| 10025927, | Mar 13 2013 | FireEye Security Holdings US LLC | Malicious content analysis with multi-version application support within single operating environment |
| 10027689, | Sep 29 2014 | FireEye Security Holdings US LLC | Interactive infection visualization for improved exploit detection and signature generation for malware and malware families |
| 10027690, | Apr 01 2004 | FireEye Security Holdings US LLC | Electronic message analysis for malware detection |
| 10027696, | Aug 22 2014 | FireEye Security Holdings US LLC | System and method for determining a threat based on correlation of indicators of compromise from other sources |
| 10033747, | Sep 29 2015 | FireEye Security Holdings US LLC | System and method for detecting interpreter-based exploit attacks |
| 10033753, | May 13 2013 | FireEye Security Holdings US LLC | System and method for detecting malicious activity and classifying a network communication based on different indicator types |
| 10050988, | Jul 01 2003 | SecurityProfiling, LLC | Computer program product and apparatus for multi-path remediation |
| 10050998, | Dec 30 2015 | FireEye Security Holdings US LLC | Malicious message analysis system |
| 10068091, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for malware containment |
| 10075455, | Dec 26 2014 | FireEye Security Holdings US LLC | Zero-day rotating guest image profile |
| 10083302, | Jun 24 2013 | FireEye Security Holdings US LLC | System and method for detecting time-bomb malware |
| 10084813, | Jun 24 2014 | FireEye Security Holdings US LLC | Intrusion prevention and remedy system |
| 10089461, | Sep 30 2013 | FireEye Security Holdings US LLC | Page replacement code injection |
| 10097573, | Apr 01 2004 | FireEye Security Holdings US LLC | Systems and methods for malware defense |
| 10104110, | Jul 01 2003 | SecurityProfiling, LLC | Anti-vulnerability system, method, and computer program product |
| 10122746, | Mar 14 2013 | FireEye Security Holdings US LLC | Correlation and consolidation of analytic data for holistic view of malware attack |
| 10133863, | Jun 24 2013 | FireEye Security Holdings US LLC | Zero-day discovery system |
| 10133864, | Jun 06 2002 | GOOGLE LLC | Methods and systems for implementing a secure application execution environment using derived user accounts for internet content |
| 10133866, | Dec 30 2015 | FireEye Security Holdings US LLC | System and method for triggering analysis of an object for malware in response to modification of that object |
| 10148693, | Mar 25 2015 | FireEye Security Holdings US LLC | Exploit detection system |
| 10154055, | Jul 01 2003 | SecurityProfiling, LLC | Real-time vulnerability monitoring |
| 10165000, | Apr 01 2004 | FireEye Security Holdings US LLC | Systems and methods for malware attack prevention by intercepting flows of information |
| 10169585, | Jun 22 2016 | FireEye Security Holdings US LLC | System and methods for advanced malware detection through placement of transition events |
| 10176321, | Dec 11 2015 | FireEye Security Holdings US LLC | Leveraging behavior-based rules for malware family classification |
| 10181029, | Feb 23 2013 | FireEye Security Holdings US LLC | Security cloud service framework for hardening in the field code of mobile software applications |
| 10192052, | Sep 30 2013 | FireEye Security Holdings US LLC | System, apparatus and method for classifying a file as malicious using static scanning |
| 10198574, | Mar 13 2013 | FireEye Security Holdings US LLC | System and method for analysis of a memory dump associated with a potentially malicious content suspect |
| 10200384, | Mar 14 2013 | FireEye Security Holdings US LLC | Distributed systems and methods for automatically detecting unknown bots and botnets |
| 10210329, | Sep 30 2015 | FireEye Security Holdings US LLC | Method to detect application execution hijacking using memory protection |
| 10218740, | Sep 30 2013 | FireEye Security Holdings US LLC | Fuzzy hash of behavioral results |
| 10242185, | Mar 21 2014 | FireEye Security Holdings US LLC | Dynamic guest image creation and rollback |
| 10282548, | Feb 24 2012 | FireEye Security Holdings US LLC | Method for detecting malware within network content |
| 10284574, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for threat detection and identification |
| 10284575, | Nov 10 2015 | FireEye Security Holdings US LLC | Launcher for setting analysis environment variations for malware detection |
| 10296437, | Feb 23 2013 | FireEye Security Holdings US LLC | Framework for efficient security coverage of mobile software applications |
| 10335738, | Jun 24 2013 | FireEye Security Holdings US LLC | System and method for detecting time-bomb malware |
| 10341363, | Mar 31 2014 | FireEye Security Holdings US LLC | Dynamically remote tuning of a malware content detection system |
| 10341365, | Dec 30 2015 | FireEye Security Holdings US LLC | Methods and system for hiding transition events for malware detection |
| 10366231, | Dec 22 2014 | FireEye Security Holdings US LLC | Framework for classifying an object as malicious with machine learning for deploying updated predictive models |
| 10380337, | Mar 31 2015 | Juniper Networks, Inc. | Configuring a sandbox environment for malware testing |
| 10404725, | Aug 22 2014 | FireEye Security Holdings US LLC | System and method of detecting delivery of malware using cross-customer data |
| 10417031, | Mar 31 2015 | FireEye Security Holdings US LLC | Selective virtualization for security threat detection |
| 10432649, | Mar 20 2014 | FireEye Security Holdings US LLC | System and method for classifying an object based on an aggregated behavior results |
| 10445502, | Dec 31 2015 | FireEye Security Holdings US LLC | Susceptible environment detection system |
| 10447728, | Dec 10 2015 | FireEye Security Holdings US LLC | Technique for protecting guest processes using a layered virtualization architecture |
| 10454950, | Jun 30 2015 | FireEye Security Holdings US LLC | Centralized aggregation technique for detecting lateral movement of stealthy cyber-attacks |
| 10454953, | Mar 28 2014 | FireEye Security Holdings US LLC | System and method for separated packet processing and static analysis |
| 10462173, | Jun 30 2016 | FireEye Security Holdings US LLC | Malware detection verification and enhancement by coordinating endpoint and malware detection systems |
| 10467411, | Dec 26 2013 | FireEye Security Holdings US LLC | System and method for generating a malware identifier |
| 10467414, | Mar 13 2013 | FireEye Security Holdings US LLC | System and method for detecting exfiltration content |
| 10469512, | May 10 2013 | FireEye Security Holdings US LLC | Optimized resource allocation for virtual machines within a malware content detection system |
| 10474813, | Mar 31 2015 | FireEye Security Holdings US LLC | Code injection technique for remediation at an endpoint of a network |
| 10476906, | Mar 25 2016 | FireEye Security Holdings US LLC | System and method for managing formation and modification of a cluster within a malware detection system |
| 10476909, | Dec 26 2013 | FireEye Security Holdings US LLC | System, apparatus and method for automatically verifying exploits within suspect objects and highlighting the display information associated with the verified exploits |
| 10491627, | Sep 29 2016 | FireEye Security Holdings US LLC | Advanced malware detection using similarity analysis |
| 10503904, | Jun 29 2017 | FireEye Security Holdings US LLC | Ransomware detection and mitigation |
| 10505956, | Jul 18 2013 | FireEye Security Holdings US LLC | System and method for detecting malicious links in electronic messages |
| 10511614, | Apr 01 2004 | FireEye Security Holdings US LLC | Subscription based malware detection under management system control |
| 10515214, | Sep 30 2013 | FireEye Security Holdings US LLC | System and method for classifying malware within content created during analysis of a specimen |
| 10523609, | Dec 27 2016 | FireEye Security Holdings US LLC | Multi-vector malware detection and analysis |
| 10528726, | Dec 29 2014 | FireEye Security Holdings US LLC | Microvisor-based malware detection appliance architecture |
| 10534906, | Feb 05 2014 | FireEye Security Holdings US LLC | Detection efficacy of virtual machine-based analysis with application specific events |
| 10552610, | Dec 22 2016 | FireEye Security Holdings US LLC | Adaptive virtual machine snapshot update framework for malware behavioral analysis |
| 10554507, | Mar 30 2017 | FireEye Security Holdings US LLC | Multi-level control for enhanced resource and object evaluation management of malware detection system |
| 10565378, | Dec 30 2015 | FireEye Security Holdings US LLC | Exploit of privilege detection framework |
| 10567405, | Apr 01 2004 | FireEye Security Holdings US LLC | System for detecting a presence of malware from behavioral analysis |
| 10572665, | Dec 28 2012 | FireEye Security Holdings US LLC | System and method to create a number of breakpoints in a virtual machine via virtual machine trapping events |
| 10581874, | Dec 31 2015 | FireEye Security Holdings US LLC | Malware detection system with contextual analysis |
| 10581879, | Dec 22 2016 | FireEye Security Holdings US LLC | Enhanced malware detection for generated objects |
| 10581898, | Dec 30 2015 | FireEye Security Holdings US LLC | Malicious message analysis system |
| 10587636, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for bot detection |
| 10587647, | Nov 22 2016 | FireEye Security Holdings US LLC | Technique for malware detection capability comparison of network security devices |
| 10592678, | Sep 09 2016 | FireEye Security Holdings US LLC | Secure communications between peers using a verified virtual trusted platform module |
| 10601848, | Jun 29 2017 | FireEye Security Holdings US LLC | Cyber-security system and method for weak indicator detection and correlation to generate strong indicators |
| 10601863, | Mar 25 2016 | FireEye Security Holdings US LLC | System and method for managing sensor enrollment |
| 10601865, | Sep 30 2015 | FireEye Security Holdings US LLC | Detection of credential spearphishing attacks using email analysis |
| 10616266, | Mar 25 2016 | FireEye Security Holdings US LLC | Distributed malware detection system and submission workflow thereof |
| 10623434, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for virtual analysis of network data |
| 10637880, | May 15 2013 | FireEye Security Holdings US LLC | Classifying sets of malicious indicators for detecting command and control communications associated with malware |
| 10642753, | Jun 30 2015 | FireEye Security Holdings US LLC | System and method for protecting a software component running in virtual machine using a virtualization layer |
| 10657251, | Sep 30 2013 | FireEye Security Holdings US LLC | Multistage system and method for analyzing obfuscated content for malware |
| 10666686, | Mar 25 2015 | FireEye Security Holdings US LLC | Virtualized exploit detection system |
| 10671721, | Mar 25 2016 | FireEye Security Holdings US LLC | Timeout management services |
| 10671726, | Sep 22 2014 | FireEye Security Holdings US LLC | System and method for malware analysis using thread-level event monitoring |
| 10673867, | Mar 30 2017 | FireEye, Inc.; FIREEYE, INC | System and method for enforcing compliance with subscription requirements for cyber-attack detection service |
| 10701091, | Mar 15 2013 | FireEye Security Holdings US LLC | System and method for verifying a cyberthreat |
| 10706149, | Sep 30 2015 | FireEye Security Holdings US LLC | Detecting delayed activation malware using a primary controller and plural time controllers |
| 10713358, | Mar 15 2013 | GOOGLE LLC | System and method to extract and utilize disassembly features to classify software intent |
| 10713362, | Sep 30 2013 | FireEye Security Holdings US LLC | Dynamically adaptive framework and method for classifying malware using intelligent static, emulation, and dynamic analyses |
| 10715542, | Aug 14 2015 | FireEye Security Holdings US LLC | Mobile application risk analysis |
| 10726127, | Jun 30 2015 | FireEye Security Holdings US LLC | System and method for protecting a software component running in a virtual machine through virtual interrupts by the virtualization layer |
| 10728263, | Apr 13 2015 | FireEye Security Holdings US LLC | Analytic-based security monitoring system and method |
| 10735458, | Sep 30 2013 | FireEye Security Holdings US LLC | Detection center to detect targeted malware |
| 10740456, | Jan 16 2014 | FireEye Security Holdings US LLC | Threat-aware architecture |
| 10747872, | Sep 27 2017 | FireEye Security Holdings US LLC | System and method for preventing malware evasion |
| 10757120, | Apr 01 2004 | FireEye Security Holdings US LLC | Malicious network content detection |
| 10757134, | Jun 24 2014 | FireEye Security Holdings US LLC | System and method for detecting and remediating a cybersecurity attack |
| 10776486, | Jun 16 2015 | NEC Corporation | Analysis system, analysis method, analysis device, and storage medium for analyzing operation of a program executed in an analysis environment |
| 10785255, | Mar 25 2016 | FireEye Security Holdings US LLC | Cluster configuration within a scalable malware detection system |
| 10791138, | Mar 30 2017 | FireEye Security Holdings US LLC | Subscription-based malware detection |
| 10795991, | Nov 08 2016 | FireEye Security Holdings US LLC | Enterprise search |
| 10798112, | Mar 30 2017 | FireEye Security Holdings US LLC | Attribute-controlled malware detection |
| 10798121, | Dec 30 2014 | FireEye Security Holdings US LLC | Intelligent context aware user interaction for malware detection |
| 10805340, | Jun 26 2014 | FireEye Security Holdings US LLC | Infection vector and malware tracking with an interactive user display |
| 10805346, | Oct 01 2017 | FireEye Security Holdings US LLC | Phishing attack detection |
| 10812513, | Mar 14 2013 | FireEye Security Holdings US LLC | Correlation and consolidation holistic views of analytic data pertaining to a malware attack |
| 10817606, | Sep 30 2015 | FireEye Security Holdings US LLC | Detecting delayed activation malware using a run-time monitoring agent and time-dilation logic |
| 10826931, | Mar 29 2018 | FireEye, Inc. | System and method for predicting and mitigating cybersecurity system misconfigurations |
| 10834107, | Nov 10 2015 | FireEye Security Holdings US LLC | Launcher for setting analysis environment variations for malware detection |
| 10846117, | Dec 10 2015 | FireEye Security Holdings US LLC | Technique for establishing secure communication between host and guest processes of a virtualization architecture |
| 10848397, | Mar 30 2017 | FireEye Security Holdings US LLC | System and method for enforcing compliance with subscription requirements for cyber-attack detection service |
| 10848521, | Mar 13 2013 | FireEye Security Holdings US LLC | Malicious content analysis using simulated user interaction without user involvement |
| 10855700, | Jun 29 2017 | FireEye Security Holdings US LLC | Post-intrusion detection of cyber-attacks during lateral movement within networks |
| 10868818, | Sep 29 2014 | FireEye Security Holdings US LLC | Systems and methods for generation of signature generation using interactive infection visualizations |
| 10872151, | Dec 30 2015 | FireEye Security Holdings US LLC | System and method for triggering analysis of an object for malware in response to modification of that object |
| 10873597, | Sep 30 2015 | FireEye Security Holdings US LLC | Cyber attack early warning system |
| 10887328, | Sep 29 2015 | FireEye Security Holdings US LLC | System and method for detecting interpreter-based exploit attacks |
| 10893059, | Mar 31 2016 | FireEye Security Holdings US LLC | Verification and enhancement using detection systems located at the network periphery and endpoint devices |
| 10893068, | Jun 30 2017 | FireEye Security Holdings US LLC | Ransomware file modification prevention technique |
| 10902117, | Dec 22 2014 | FireEye Security Holdings US LLC | Framework for classifying an object as malicious with machine learning for deploying updated predictive models |
| 10902119, | Mar 30 2017 | FireEye Security Holdings US LLC | Data extraction system for malware analysis |
| 10904286, | Mar 24 2017 | FireEye Security Holdings US LLC | Detection of phishing attacks using similarity analysis |
| 10922403, | Jun 06 2002 | GOOGLE LLC | Methods and systems for implementing a secure application execution environment using derived user accounts for internet content |
| 10929266, | Feb 23 2013 | FireEye Security Holdings US LLC | Real-time visual playback with synchronous textual analysis log display and event/time indexing |
| 10956477, | Mar 30 2018 | GOOGLE LLC | System and method for detecting malicious scripts through natural language processing modeling |
| 11003773, | Mar 30 2018 | FireEye Security Holdings US LLC | System and method for automatically generating malware detection rule recommendations |
| 11005860, | Dec 28 2017 | GOOGLE LLC | Method and system for efficient cybersecurity analysis of endpoint events |
| 11068587, | Mar 21 2014 | FireEye Security Holdings US LLC | Dynamic guest image creation and rollback |
| 11075930, | Jun 27 2018 | FireEye Security Holdings US LLC | System and method for detecting repetitive cybersecurity attacks constituting an email campaign |
| 11075945, | Sep 30 2013 | FireEye Security Holdings US LLC | System, apparatus and method for reconfiguring virtual machines |
| 11082435, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for threat detection and identification |
| 11082436, | Mar 28 2014 | FireEye Security Holdings US LLC | System and method for offloading packet processing and static analysis operations |
| 11089057, | Dec 26 2013 | FireEye Security Holdings US LLC | System, apparatus and method for automatically verifying exploits within suspect objects and highlighting the display information associated with the verified exploits |
| 11108809, | Oct 27 2017 | GOOGLE LLC | System and method for analyzing binary code for malware classification using artificial neural network techniques |
| 11113086, | Jun 30 2015 | FireEye Security Holdings US LLC | Virtual system and method for securing external network connectivity |
| 11153341, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for detecting malicious network content using virtual environment components |
| 11182473, | Sep 13 2018 | FireEye Security Holdings US LLC | System and method for mitigating cyberattacks against processor operability by a guest process |
| 11200080, | Dec 11 2015 | FireEye Security Holdings US LLC | Late load technique for deploying a virtualization layer underneath a running operating system |
| 11210390, | Mar 13 2013 | FireEye Security Holdings US LLC | Multi-version application support and registration within a single operating system environment |
| 11228491, | Jun 28 2018 | FireEye Security Holdings US LLC | System and method for distributed cluster configuration monitoring and management |
| 11240262, | Jun 30 2016 | FireEye Security Holdings US LLC | Malware detection verification and enhancement by coordinating endpoint and malware detection systems |
| 11240275, | Dec 28 2017 | FireEye Security Holdings US LLC | Platform and method for performing cybersecurity analyses employing an intelligence hub with a modular architecture |
| 11244044, | Sep 30 2015 | FireEye Security Holdings US LLC | Method to detect application execution hijacking using memory protection |
| 11244056, | Jul 01 2014 | FireEye Security Holdings US LLC | Verification of trusted threat-aware visualization layer |
| 11258806, | Jun 24 2019 | GOOGLE LLC | System and method for automatically associating cybersecurity intelligence to cyberthreat actors |
| 11271955, | Dec 28 2017 | FireEye Security Holdings US LLC | Platform and method for retroactive reclassification employing a cybersecurity-based global data store |
| 11294705, | Mar 31 2015 | FireEye Security Holdings US LLC | Selective virtualization for security threat detection |
| 11297074, | Mar 31 2014 | FireEye Security Holdings US LLC | Dynamically remote tuning of a malware content detection system |
| 11314859, | Jun 27 2018 | FireEye Security Holdings US LLC | Cyber-security system and method for detecting escalation of privileges within an access token |
| 11316900, | Jun 29 2018 | FireEye Security Holdings US LLC | System and method for automatically prioritizing rules for cyber-threat detection and mitigation |
| 11368475, | Dec 21 2018 | FireEye Security Holdings US LLC | System and method for scanning remote services to locate stored objects with malware |
| 11381578, | Jan 13 2012 | FireEye Security Holdings US LLC | Network-based binary file extraction and analysis for malware detection |
| 11392700, | Jun 28 2019 | FireEye Security Holdings US LLC | System and method for supporting cross-platform data verification |
| 11399040, | Mar 30 2017 | FireEye Security Holdings US LLC | Subscription-based malware detection |
| 11552986, | Dec 31 2015 | FireEye Security Holdings US LLC | Cyber-security framework for application of virtual features |
| 11556640, | Jun 27 2019 | GOOGLE LLC | Systems and methods for automated cybersecurity analysis of extracted binary string sets |
| 11558401, | Mar 30 2018 | FireEye Security Holdings US LLC | Multi-vector malware detection data sharing system for improved detection |
| 11563765, | Apr 10 2020 | ATTACKIQ, INC | Method for emulating a known attack on a target computer network |
| 11570211, | Mar 24 2017 | FireEye Security Holdings US LLC | Detection of phishing attacks using similarity analysis |
| 11632392, | Mar 25 2016 | FireEye Security Holdings US LLC | Distributed malware detection system and submission workflow thereof |
| 11637857, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for detecting malicious traffic using a virtual machine configured with a select software environment |
| 11637859, | Oct 27 2017 | GOOGLE LLC | System and method for analyzing binary code for malware classification using artificial neural network techniques |
| 11637862, | Sep 30 2019 | GOOGLE LLC | System and method for surfacing cyber-security threats with a self-learning recommendation engine |
| 11677775, | Apr 10 2020 | AttackIQ, Inc. | System and method for emulating a multi-stage attack on a node within a target network |
| 11763004, | Sep 27 2018 | FireEye Security Holdings US LLC | System and method for bootkit detection |
| 11856011, | Mar 30 2018 | Musarubra US LLC | Multi-vector malware detection data sharing system for improved detection |
| 11863581, | Mar 30 2017 | Musarubra US LLC | Subscription-based malware detection |
| 11868795, | Mar 31 2015 | Musarubra US LLC | Selective virtualization for security threat detection |
| 11876829, | Apr 10 2020 | AttackIQ, Inc. | Method for emulating a known attack on a target computer network |
| 11882140, | Jun 27 2018 | FireEye Security Holdings US LLC | System and method for detecting repetitive cybersecurity attacks constituting an email campaign |
| 11886585, | Sep 27 2019 | Musarubra US LLC | System and method for identifying and mitigating cyberattacks through malicious position-independent code execution |
| 7234167, | Sep 06 2001 | JPMORGAN CHASE BANK, N A , AS ADMINISTRATIVE AGENT | Automatic builder of detection and cleaning routines for computer viruses |
| 7409718, | Mar 14 2003 | Ajou University Industry Cooperation Foundation | Method of decrypting and analyzing encrypted malicious scripts |
| 7490268, | Jun 01 2004 | The Trustees of Columbia University in the City of New York | Methods and systems for repairing applications |
| 7730530, | Jan 30 2004 | Microsoft Technology Licensing, LLC | System and method for gathering exhibited behaviors on a .NET executable module in a secure manner |
| 7913305, | Jan 30 2004 | Microsoft Technology Licensing, LLC | System and method for detecting malware in an executable code module according to the code module's exhibited behavior |
| 8024815, | Sep 15 2006 | Microsoft Technology Licensing, LLC | Isolation environment-based information access |
| 8028273, | Aug 28 2003 | GLOBALFOUNDRIES Inc | Program product providing a configuration specification language having clone latch support |
| 8176477, | Sep 14 2007 | KYNDRYL, INC | Method, system and program product for optimizing emulation of a suspected malware |
| 8473931, | Sep 14 2007 | KYNDRYL, INC | Method, system and program product for optimizing emulation of a suspected malware |
| 8479293, | Nov 30 2000 | ACCESS CO , LTD | Security technique for an open computing platform system |
| 8793787, | Apr 01 2004 | FireEye Security Holdings US LLC | Detecting malicious network content using virtual environment components |
| 8826245, | Sep 14 2007 | KYNDRYL, INC | Method, system and program product for optimizing emulation of a suspected malware |
| 8832829, | Sep 30 2009 | FireEye Security Holdings US LLC | Network-based binary file extraction and analysis for malware detection |
| 8850571, | Nov 03 2008 | FireEye Security Holdings US LLC | Systems and methods for detecting malicious network content |
| 8881282, | Apr 01 2004 | FireEye Security Holdings US LLC | Systems and methods for malware attack detection and identification |
| 8898788, | Apr 01 2004 | FireEye Security Holdings US LLC | Systems and methods for malware attack prevention |
| 8935779, | Sep 30 2009 | FireEye Security Holdings US LLC | Network-based binary file extraction and analysis for malware detection |
| 8984638, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for analyzing suspicious network data |
| 8984644, | Jul 01 2003 | SecurityProfiling, LLC | Anti-vulnerability system, method, and computer program product |
| 8990939, | Nov 03 2008 | FireEye Security Holdings US LLC | Systems and methods for scheduling analysis of network content for malware |
| 8990944, | Feb 23 2013 | FireEye Security Holdings US LLC | Systems and methods for automatically detecting backdoors |
| 8997219, | Nov 03 2008 | FireEye Security Holdings US LLC | Systems and methods for detecting malicious PDF network content |
| 9009822, | Feb 23 2013 | FireEye Security Holdings US LLC | Framework for multi-phase analysis of mobile applications |
| 9009823, | Feb 23 2013 | FireEye Security Holdings US LLC | Framework for efficient security coverage of mobile software applications installed on mobile devices |
| 9027130, | Apr 01 2004 | FireEye, Inc. | Systems and methods for unauthorized activity defense |
| 9027135, | Jun 14 2004 | FireEye Security Holdings US LLC | Prospective client identification using malware attack detection |
| 9071638, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for malware containment |
| 9100431, | Jul 01 2003 | SecurityProfiling, LLC | Computer program product and apparatus for multi-path remediation |
| 9104867, | Mar 13 2013 | FireEye Security Holdings US LLC | Malicious content analysis using simulated user interaction without user involvement |
| 9106694, | Apr 01 2004 | FireEye Security Holdings US LLC | Electronic message analysis for malware detection |
| 9117069, | Jul 01 2003 | SecurityProfiling, LLC | Real-time vulnerability monitoring |
| 9118708, | Jul 01 2003 | SecurityProfiling, LLC | Multi-path remediation |
| 9118709, | Jul 01 2003 | SecurityProfiling, LLC | Anti-vulnerability system, method, and computer program product |
| 9118710, | Jul 01 2003 | SecurityProfiling, LLC | System, method, and computer program product for reporting an occurrence in different manners |
| 9118711, | Jul 01 2003 | SecurityProfiling, LLC | Anti-vulnerability system, method, and computer program product |
| 9118715, | Nov 03 2008 | FireEye Security Holdings US LLC | Systems and methods for detecting malicious PDF network content |
| 9159035, | Feb 23 2013 | FireEye Security Holdings US LLC | Framework for computer application analysis of sensitive information tracking |
| 9171149, | Jun 06 2002 | GOOGLE LLC | Methods and systems for implementing a secure application execution environment using derived user accounts for internet content |
| 9171160, | Sep 30 2013 | FireEye Security Holdings US LLC | Dynamically adaptive framework and method for classifying malware using intelligent static, emulation, and dynamic analyses |
| 9176843, | Feb 23 2013 | FireEye Security Holdings US LLC | Framework for efficient security coverage of mobile software applications |
| 9189627, | Nov 21 2013 | FireEye Security Holdings US LLC | System, apparatus and method for conducting on-the-fly decryption of encrypted objects for malware detection |
| 9195829, | Feb 23 2013 | FireEye Security Holdings US LLC | User interface with real-time visual playback along with synchronous textual analysis log display and event/time index for anomalous behavior detection in applications |
| 9197664, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for malware containment |
| 9223972, | Mar 31 2014 | FireEye Security Holdings US LLC | Dynamically remote tuning of a malware content detection system |
| 9225686, | Jul 01 2003 | SecurityProfiling, LLC | Anti-vulnerability system, method, and computer program product |
| 9225740, | Feb 23 2013 | FireEye Security Holdings US LLC | Framework for iterative analysis of mobile software applications |
| 9241010, | Mar 20 2014 | FireEye Security Holdings US LLC | System and method for network behavior detection |
| 9251343, | Mar 15 2013 | FireEye Security Holdings US LLC | Detecting bootkits resident on compromised computers |
| 9262635, | Feb 05 2014 | FireEye Security Holdings US LLC | Detection efficacy of virtual machine-based analysis with application specific events |
| 9282109, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for analyzing packets |
| 9294501, | Sep 30 2013 | FireEye Security Holdings US LLC | Fuzzy hash of behavioral results |
| 9300686, | Jun 28 2013 | FireEye Security Holdings US LLC | System and method for detecting malicious links in electronic messages |
| 9306960, | Apr 01 2004 | FireEye Security Holdings US LLC | Systems and methods for unauthorized activity defense |
| 9306974, | Dec 26 2013 | FireEye Security Holdings US LLC | System, apparatus and method for automatically verifying exploits within suspect objects and highlighting the display information associated with the verified exploits |
| 9311479, | Mar 14 2013 | FireEye Security Holdings US LLC | Correlation and consolidation of analytic data for holistic view of a malware attack |
| 9350752, | Jul 01 2003 | SecurityProfiling, LLC | Anti-vulnerability system, method, and computer program product |
| 9355247, | Mar 13 2013 | FireEye Security Holdings US LLC | File extraction from memory dump for malicious content analysis |
| 9356944, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for detecting malicious traffic using a virtual machine configured with a select software environment |
| 9363280, | Aug 22 2014 | FireEye Security Holdings US LLC | System and method of detecting delivery of malware using cross-customer data |
| 9367681, | Feb 23 2013 | FireEye Security Holdings US LLC | Framework for efficient security coverage of mobile software applications using symbolic execution to reach regions of interest within an application |
| 9398028, | Jun 26 2014 | FireEye Security Holdings US LLC | System, device and method for detecting a malicious attack based on communcations between remotely hosted virtual machines and malicious web servers |
| 9430646, | Mar 14 2013 | FireEye Security Holdings US LLC | Distributed systems and methods for automatically detecting unknown bots and botnets |
| 9432389, | Mar 31 2014 | FireEye Security Holdings US LLC | System, apparatus and method for detecting a malicious attack based on static analysis of a multi-flow object |
| 9438613, | Mar 30 2015 | FireEye Security Holdings US LLC | Dynamic content activation for automated analysis of embedded objects |
| 9438622, | Nov 03 2008 | FireEye Security Holdings US LLC | Systems and methods for analyzing malicious PDF network content |
| 9438623, | Jun 06 2014 | FireEye Security Holdings US LLC | Computer exploit detection using heap spray pattern matching |
| 9477837, | Mar 31 2015 | Juniper Networks, Inc. | Configuring a sandbox environment for malware testing |
| 9483644, | Mar 31 2015 | FireEye Security Holdings US LLC | Methods for detecting file altering malware in VM based analysis |
| 9495180, | May 10 2013 | FireEye Security Holdings US LLC | Optimized resource allocation for virtual machines within a malware content detection system |
| 9516057, | Apr 01 2004 | FireEye Security Holdings US LLC | Systems and methods for computer worm defense |
| 9519782, | Feb 24 2012 | FireEye Security Holdings US LLC | Detecting malicious network content |
| 9536091, | Jun 24 2013 | FireEye Security Holdings US LLC | System and method for detecting time-bomb malware |
| 9560059, | Nov 21 2013 | FireEye Security Holdings US LLC | System, apparatus and method for conducting on-the-fly decryption of encrypted objects for malware detection |
| 9565202, | Mar 13 2013 | FireEye Security Holdings US LLC | System and method for detecting exfiltration content |
| 9589135, | Sep 29 2014 | FireEye, Inc. | Exploit detection of malware and malware families |
| 9591015, | Mar 28 2014 | FireEye Security Holdings US LLC | System and method for offloading packet processing and static analysis operations |
| 9591020, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for signature generation |
| 9594904, | Apr 23 2015 | FireEye Security Holdings US LLC | Detecting malware based on reflection |
| 9594905, | Feb 23 2013 | FireEye Security Holdings US LLC | Framework for efficient security coverage of mobile software applications using machine learning |
| 9594912, | Jun 06 2014 | FireEye Security Holdings US LLC | Return-oriented programming detection |
| 9596258, | Sep 30 2013 | FireEye, Inc. | System, apparatus and method for using malware analysis results to drive adaptive instrumentation of virtual machines to improve exploit detection |
| 9609007, | Aug 22 2014 | FireEye Security Holdings US LLC | System and method of detecting delivery of malware based on indicators of compromise from different sources |
| 9626509, | Mar 13 2013 | FireEye Security Holdings US LLC | Malicious content analysis with multi-version application support within single operating environment |
| 9628498, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for bot detection |
| 9628507, | Sep 30 2013 | FireEye Security Holdings US LLC | Advanced persistent threat (APT) detection center |
| 9635039, | May 15 2013 | FireEye Security Holdings US LLC | Classifying sets of malicious indicators for detecting command and control communications associated with malware |
| 9641546, | Mar 14 2013 | FireEye Security Holdings US LLC | Electronic device for aggregation, correlation and consolidation of analysis attributes |
| 9661009, | Jun 26 2014 | FireEye Security Holdings US LLC | Network-based malware detection |
| 9661018, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for detecting anomalous behaviors using a virtual machine environment |
| 9690606, | Mar 25 2015 | FireEye Security Holdings US LLC | Selective system call monitoring |
| 9690933, | Dec 22 2014 | FireEye Security Holdings US LLC | Framework for classifying an object as malicious with machine learning for deploying updated predictive models |
| 9690936, | Sep 30 2013 | FireEye Security Holdings US LLC | Multistage system and method for analyzing obfuscated content for malware |
| 9736179, | Sep 30 2013 | FireEye Security Holdings US LLC | System, apparatus and method for using malware analysis results to drive adaptive instrumentation of virtual machines to improve exploit detection |
| 9740853, | Mar 31 2015 | Juniper Networks, Inc. | Configuring a sandbox environment for malware testing |
| 9747446, | Dec 26 2013 | FireEye Security Holdings US LLC | System and method for run-time object classification |
| 9756074, | Dec 26 2013 | FireEye Security Holdings US LLC | System and method for IPS and VM-based detection of suspicious objects |
| 9773112, | Sep 29 2014 | FireEye Security Holdings US LLC | Exploit detection of malware and malware families |
| 9787700, | Mar 28 2014 | FireEye Security Holdings US LLC | System and method for offloading packet processing and static analysis operations |
| 9792196, | Feb 23 2013 | FireEye Security Holdings US LLC | Framework for efficient security coverage of mobile software applications |
| 9824209, | Feb 23 2013 | FireEye Security Holdings US LLC | Framework for efficient security coverage of mobile software applications that is usable to harden in the field code |
| 9824216, | Dec 31 2015 | FireEye Security Holdings US LLC | Susceptible environment detection system |
| 9825976, | Sep 30 2015 | FireEye Security Holdings US LLC | Detection and classification of exploit kits |
| 9825989, | Sep 30 2015 | FireEye Security Holdings US LLC | Cyber attack early warning system |
| 9832212, | Apr 01 2004 | FireEye, Inc. | Electronic message analysis for malware detection |
| 9838408, | Jun 26 2014 | FireEye Security Holdings US LLC | System, device and method for detecting a malicious attack based on direct communications between remotely hosted virtual machines and malicious web servers |
| 9838411, | Apr 01 2004 | FireEye Security Holdings US LLC | Subscriber based protection system |
| 9838416, | Jun 14 2004 | FireEye Security Holdings US LLC | System and method of detecting malicious content |
| 9838417, | Dec 30 2014 | FireEye Security Holdings US LLC | Intelligent context aware user interaction for malware detection |
| 9846776, | Mar 31 2015 | FireEye Security Holdings US LLC | System and method for detecting file altering behaviors pertaining to a malicious attack |
| 9888016, | Jun 28 2013 | FireEye Security Holdings US LLC | System and method for detecting phishing using password prediction |
| 9888019, | Jul 18 2013 | FireEye Security Holdings US LLC | System and method for detecting malicious links in electronic messages |
| 9910988, | Sep 30 2013 | FireEye Security Holdings US LLC | Malware analysis in accordance with an analysis plan |
| 9912684, | Apr 01 2004 | FireEye Security Holdings US LLC | System and method for virtual analysis of network data |
| 9912691, | Sep 30 2013 | FireEye Security Holdings US LLC | Fuzzy hash of behavioral results |
| 9912698, | Mar 13 2013 | FireEye Security Holdings US LLC | Malicious content analysis using simulated user interaction without user involvement |
| 9916440, | Feb 05 2014 | FireEye Security Holdings US LLC | Detection efficacy of virtual machine-based analysis with application specific events |
| 9921978, | Nov 08 2013 | FireEye Security Holdings US LLC | System and method for enhanced security of storage devices |
| 9934381, | Mar 13 2013 | FireEye Security Holdings US LLC | System and method for detecting malicious activity based on at least one environmental property |
| 9954890, | Nov 03 2008 | FireEye, Inc. | Systems and methods for analyzing PDF documents |
| 9973531, | Jun 06 2014 | FireEye Security Holdings US LLC | Shellcode detection |
| Patent | Priority | Assignee | Title |
| 5619698, | May 05 1995 | Apple Inc | Method and apparatus for patching operating systems |
| 6014702, | Jun 04 1997 | International Business Machines Corporation; IBM Corporation | Host information access via distributed programmed objects |
| 6035405, | Dec 22 1997 | AVAYA Inc | Secure virtual LANs |
| 6112304, | Aug 27 1997 | Zipsoft, Inc.; ZIPSOFT, INC | Distributed computing architecture |
| 6275938, | Aug 28 1997 | Microsoft Technology Licensing, LLC | Security enhancement for untrusted executable code |
| 20030177485, |
| Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
| Jun 01 2000 | Networks Associates Technology, Inc. | (assignment on the face of the patent) | / | |||
| Jun 01 2000 | LONG, DUNCAN V | Network Associates, Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 010834 | /0047 | |
| Jun 01 2000 | MUTTIK, IGOR | Network Associates, Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 010834 | /0047 | |
| Jun 26 2003 | Network Associates, Inc | NETWORKS ASSOCIATES TECHNOLOGY, INC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 014217 | /0644 | |
| Nov 19 2004 | NETWORKS ASSOCIATES TECHNOLOGY, INC | McAfee, Inc | MERGER SEE DOCUMENT FOR DETAILS | 019974 | /0665 | |
| Dec 20 2016 | McAfee, Inc | McAfee, LLC | CHANGE OF NAME AND ENTITY CONVERSION | 043665 | /0918 | |
| Sep 29 2017 | McAfee, LLC | JPMORGAN CHASE BANK, N A | CORRECTIVE ASSIGNMENT TO CORRECT THE REMOVE PATENT 6336186 PREVIOUSLY RECORDED ON REEL 045055 FRAME 786 ASSIGNOR S HEREBY CONFIRMS THE SECURITY INTEREST | 055854 | /0047 | |
| Sep 29 2017 | McAfee, LLC | MORGAN STANLEY SENIOR FUNDING, INC | SECURITY INTEREST SEE DOCUMENT FOR DETAILS | 045056 | /0676 | |
| Sep 29 2017 | McAfee, LLC | MORGAN STANLEY SENIOR FUNDING, INC | CORRECTIVE ASSIGNMENT TO CORRECT THE REMOVE PATENT 6336186 PREVIOUSLY RECORDED ON REEL 045056 FRAME 0676 ASSIGNOR S HEREBY CONFIRMS THE SECURITY INTEREST | 054206 | /0593 | |
| Sep 29 2017 | McAfee, LLC | JPMORGAN CHASE BANK, N A | SECURITY INTEREST SEE DOCUMENT FOR DETAILS | 045055 | /0786 | |
| Oct 26 2020 | JPMORGAN CHASE BANK, N A , AS COLLATERAL AGENT | McAfee, LLC | RELEASE OF INTELLECTUAL PROPERTY COLLATERAL - REEL FRAME 045055 0786 | 054238 | /0001 | |
| Mar 01 2022 | MORGAN STANLEY SENIOR FUNDING, INC , AS COLLATERAL AGENT | McAfee, LLC | RELEASE OF INTELLECTUAL PROPERTY COLLATERAL - REEL FRAME 045056 0676 | 059354 | /0213 |
| Date | Maintenance Fee Events |
| Jun 30 2008 | M1551: Payment of Maintenance Fee, 4th Year, Large Entity. |
| Mar 07 2011 | ASPN: Payor Number Assigned. |
| Mar 07 2011 | RMPN: Payer Number De-assigned. |
| Jun 14 2012 | M1552: Payment of Maintenance Fee, 8th Year, Large Entity. |
| Dec 01 2016 | M1553: Payment of Maintenance Fee, 12th Year, Large Entity. |
| Date | Maintenance Schedule |
| Jun 14 2008 | 4 years fee payment window open |
| Dec 14 2008 | 6 months grace period start (w surcharge) |
| Jun 14 2009 | patent expiry (for year 4) |
| Jun 14 2011 | 2 years to revive unintentionally abandoned end. (for year 4) |
| Jun 14 2012 | 8 years fee payment window open |
| Dec 14 2012 | 6 months grace period start (w surcharge) |
| Jun 14 2013 | patent expiry (for year 8) |
| Jun 14 2015 | 2 years to revive unintentionally abandoned end. (for year 8) |
| Jun 14 2016 | 12 years fee payment window open |
| Dec 14 2016 | 6 months grace period start (w surcharge) |
| Jun 14 2017 | patent expiry (for year 12) |
| Jun 14 2019 | 2 years to revive unintentionally abandoned end. (for year 12) |